DECEMBER 2015 


Current Board of Directors 


Charlie NN3V President 

Joe K6JPE Vice President 

Jim NE60 Director 

Greg KI6RXX Director 

Gary W6GDK Secretary 

Richard KJ6WUY Treasurer 

Dennis Baca KD6TUJ Repeater Site Chair 
Glen KJ6ZQH Membership 

Mark KF6WTN Repeater Technical Chair 


Nominations for the 2016 Board were 
announced at the November membership 
meeting and are as follows. 


Charlie NN3V President 
Joe K6JPE Vice President 
Kevin KK6FRK Director 
John AC7GK Director 
Sandy KK6EED Secretary 
Tom WONI Treasurer 


There are three additional directors. These 
directors are selected from four appointed 
positions, which include Repeater Site Chair, 
Repeater Technical Chair, Membership Chair, 
and Newsletter Chair. 


Elections for 2016 Board will be held at the 
December membership meeting. 


In addition to the board of directors election, 
a ballot of YES or NO for “Shall Palomar 
Amateur Radio Club grant life membership to 
Mike Pennington K6MRP?” will be held at the 
December membership meeting. 


Save the Date 


Club Meeting Board Meeting Club Events 
2 December 2015 9 December 2015 5-7 December 2015 


PARC board elections Palomar Amateur Radio Ft. Rosecrans Goes To 
for 2016 and our annual Club board meeting at War - special event 
Holiday Potluck Party! 7:00pm at Poway Fire station, vintage radios, 
Station on Community and living history 
Road at Cabrillo National 
Monument. 
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Club Financial Update 

Reported Repeater Status as of 27 Nov 
PARC Members Support Education 
Reported ATV Status as of 27 Nov 
Yuma Hamfest Announcement 
W6NWG Awarded Worked All States 
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Operating Day at Fry’s San Marcos 
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Technical Articles 
\ Yaesu MH-85A11U Teardown 


Signal Adventures: SigGens from China 
Repeater Site Technical Video Report 


Advertisements are free for members 


Have items that need to find a new home? Advertise here! Send your ads to scope@palomararc.org 


Club Members ONLY! 

PARC has a tube bank that includes many 6 & 12 volt receiving tubes (and some 
transmitting types) for use by club members to repair their own personal equipment. 
Not for commercial use or resale. If we have your requests, we will pre-check the 
tubes and deliver them to you at the next club meeting. 


Contact John WB6IQS WB6IQS@att.net 
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President's Corner 


A joyous Merry Christmas and Happy New year to all! May Santa’s sleigh come loaded with ham 
candy for you, and may you and all your loved ones have a healthy and wealthy New Year! 


As we near the holiday season, and beginning of a new year, there are many thoughts upon which to 
reflect and plan. 


The December club meeting will feature our traditional Christmas special social event, as well as the 
elections for the PARC 2016 Board of Directors. Bring some goodies to share with your fellow club 
members. It will also be the time for election of the 2016 PARC Board of directors, as announced at 
last month's meeting. 


At the meeting you will also have the opportunity of voting for whether or not PARC should award 

an honorary life membership for Mike Pennington KEMRP, a PARC member now living far from San 
Diego (Montana...BRRR), who devoted a tremendous effort in technical work for PARC for many 
years while he lived here. The honorary life membership award is offered to Club members who have 
distinguished themselves in service to the ham radio community. I hope you will support the award. 


As a preview of exciting things to come, in January we hope to host a unique club program. Gene 
Spinelli KG5S was a leader of the TX3X DXpedition to Chesterfield Island this year. Chesterfield 

Island is located 6600 miles West/Southwest from San Diego, midway between New Caledonia and 
Australia. The name “island” is somewhat of an aggrandizement. It is more specifically a rock reef in 
the middle of nowhere, but if you are a DX hound, it represents one of the most cherished DX entities 
in the world. Gene will describe the work that went into planning the We to Chesterfield, and 
talk about the fun of facing the pile ups on the receiving end of “CQ TX3 


I hope many of you have the opportunity to participate in the Ft. Rosecrans Goes to War special 
event on December 5-7 at Cabrillo National Monument at Pt. Loma. This event, organized by PARC 
Club members Gayle K6GO and Mike NA6MB is likely to be an exceptional and fun filled event with 
ham radio and vintage WW-II radios on exhibit. You may contact Gayle and Mike at K6GO@rrl.net 
and NA6M@arrl.net. They are looking for voluntary assistance to operate some radio equipment 
(SSB, CW, and digital) on the 5th. and 6th. I will be thinking of the event while I commemorate the 
Pearl Harbor anniversary at Arlington National Cemetery in DC. 


Ft. Rosecrans Goes To War Event Information 


The Cabrillo National Monument Foundation in San Diego, CA is sponsoring an event called “Fort 
Rosecrans Goes to War” and the local amateur radio community is participating by operating a special 
event station, W6W, from Fort Rosecrans on December 5 and 6 


The amateur radio operators are setting up radios and antennas on Saturday December 5 and 
Sunday December 6 from 9:00 AM to 4:00 PM. The hams will commemorate the event by making 
as many radio contacts as possible and exchanging an event postcard with stations reached locality, 
nationality and internationally. 


A special event call sign had been obtained from the FCC and the station will use W6W. 


There will be vintage WWII radios on display and operating at the event! 

Those visiting will see a hands on demonstration of amateur radio in action. 

Please come by and visit, either in person or on the air. We will be on the circular drive just outside of 
the Cabrillo National Monument visitor center and operating on HF, VHF and UHF bands. 

For more information or to volunteer for an operating time. 


K6GO@arrl.net 


NA6MB@arrl.net 
(619) 494-1204 
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New Committee Chair 


It’s been a while since PARC had an active committee system. In the October 2005 Scope, the list 
included ARES Info, ARES Net, Attendance, ATV, Auction, Badges (New), Batteries, BBS Monitor, 
Billing Ads/etc, Contest Info, Control Ops, Del Mar Fair, EmComm, Field Day Tech, Inventory, New 
Member, Nets, Newsletter, Patch Info, Patch Electronics, Picnic, Power AC/DC, Programs, Publicity, 
QSL Cards, RACES Info, RED Flag, Repeater Site, Repeater Tech, SANDARC, Seller Table, Testing, VE, 
Trustee, and Web. 


The club is reviving the committee system and will be welcoming new chairs. If you are willing to 
serve, or have an idea for a particular chair that you believe the club needs, please contact the board 
at board@palomararc.org. 


Some of these positions are no longer relevant. For example, since we don’t have a phone patch, we 
don’t currently need a committee chair for that position. 

It's our pleasure to announce a new Committee Chair for PARC. This chair reports to our club 
president, Charlie NN3V. 


New Chair for Operating Day 

An Operating Day Chair has been established for Palomar Amateur Radio Club. Tom Martin KERCW 
has been organizing Operating Day for several years. He has generously agreed to be listed as PARC’s 
Operating Day Chair. Tom welcomes volunteers to help make Operating Day bigger and better each 
time. 


Operating Day is twice a year, once in the fall and once in the spring. Our most recent Operating Day 


was 7 November 2015, and was held from 9:00am to 4:00pm at both Fry’s Electronics in San Diego 
and Fry’s Electronics in San Marcos. 


committee [chair [contact 
EchoLink Bernie Lafreniere N6FN n6fn@niftyaccessories.com 


Phil Karn KA9Q karn@ka9q.net 


Operating Day | Tom Martin KERCW k6rcw@amsat.org 


Tech Tip from Dennis N6KI 


FYI - Besides an Emergency Car Starter, also great for a nice Phone or Laptop emergency charger 
and can power your 12 VDC devices like a 5 Watt QRP Ham Radio Transceiver or SDR etc. 


Also has a fairly good flashlight in it that can stobe and also send SOS for hours. I am testing right 
now to see how long it can send SOS with the fairly bright light. 


I'll report back in a few days I imagine as it’s been sending SOS for 5 hours and the #5 of 5 Blue LED 
battery charge indicator lamps has not extinguished! 


http://www.tooltopia.com/rockford-8005.aspx 


$50 with free ship from ToolTopia. Amazon wants $20 more for same device! 


SCOPE page 4 


Club Financial Update 
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OMPAWN ¥ 


; t aa RF Led Complete inventory for servicing amateur Please 


and commercial communications @quipment 


Support our 
R TRANSISTORS — TUBES — POWER MODULES d ti 
@s * Relays * Trimmers * Capacitors * Heatsinks d Ver ISETS. 
mers + Chokes + Combiners * Wattmeters - Books I Their Support 
3-500ZG « B11a + 5728 + 4-400a + 6146B - 8072 + B560AS : 
Seeing ssox:200ar/017z7 «9cx1s0007 <a of the club ts 
4C0X250B + 4CX250R + 4CX400A + 4CX800A + 40X1500B vital 


Marit WENO + Gary K6CAQ « Steve KENDG + Rob WA6GYG * Doug K6DRA 


760-744-0700 [special] 
www.rfparts.com +» orderserfparts.com im Oe THANKS 


fo Our Sponsors 


Club HF Remote Station? Proposal Time! 


Current status: PARC has obtained 501(c)(3) status, and we have begun putting our HF remote 
station proposal in writing. This is an exciting time! We expect to complete our proposal by January 
016. 


If you would be interested in helping write a club remote HF station proposal for Palomar Mountain, 
then please join up by writing me at scope@palomararc.org and I'll add you to the mailing list! 


Mailing list archive located at 
http://palomararc.org/pipermail/hfremote/ 


This special interest group for HF remote will write a proposal for the Palomar Amateur Radio Club 
board of directors to vote on. If the vote is successful, then fundraising will begin immediately. 


; Ss 
zB Michelle Thompson asked a questior What's your opinion: 


Lat 1 Portrait or landscape 


Ne ; (or other option) for the 
For the digital version of the Scope, how do you prefer it to look? digital version of the 
Let us know at 


O Scope? 
scope@palomararc.org 


it (th itl in PDF fo 
portrait (the way it is now in im) — Portrait has taken a 


j I 
landacape (wider than it ia tall) commanding lead! 


But with landscape pages as needed 
(e.g., for dlagrams). 


Suggestion to make each 
page single-column for 
easier mobile reading has 
been implemented. 
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146.700 | 
packet duplex repeater, 
Duplex 


| operational 
non-operational 


Across 
1 Economical (4) 


3 Ocean of 
Guinness (5,3) 


9 Park (7) 
10 Broadcasting 
(2,3) 
11 Japanese- 
American (5) 


12 Monopoly 
property (6) 

14 often filled with 
lavender (6) 


16 Siberian Lake (6) 


19 View from Jidda 
(3,3) 


21 Swiss capital (5) 


24 Reddish brown 
(5) 


25 Soft leather (7) 


26 Not South Sea 
(5,3) 
27 Greek cheese (4) 


Down 


1 Mysterious sea 
monster (4,4) 

2 "Bye" (5) 

4 Plural of 
impractically 
large antenna (6) 


5 Ribbon holder 
(5) 


6 What you might 
suffer from on 
the ocean (7) 


7 Breezy (4) 
8 Kind of case (6) 


13 Not White Sea 
(5,3) 

15 Janitor (7) 

17 Brawl (6) 

18 Not smooth (6) 

20 #1 song (5) 

22 Building block 


23 Top Tatar (4) 
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Decode the secret phrase in this logo above and win a patch. 
Answers to scope@palomararc.org 
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FERRITES FOR HAMS 


Ferrite — Toroids, Slip-on, Snap-on 

Mix 31, 43, 61, 77 for Baluns/Ununs, RFI/EMI 
Quantity pricing for Clubs, DXpeditions 
Antenna Balun/Unun - kits or assembled 

1:1, 2:1, 4:1, 9:1 for dipoles, verticals, GSRV, 
loops, OCF, end fed, NVIS, quad, yagi antennas 


RFI Kits - home, mobile, or portable operation 
Free Tip Sheet to cure RFI, reduce radio noise, 
work more DX and keep your neighbors happy! 


Palomar Engineers™ 


www.Palomar-Engineers.com 
760-747-3343 
We Ship Worldwide 


Doe a 


woe CY 


Callsign Confusion 


Being new to the club and amateur 
radio, I knew enough about operating 
to know that you need to give your 
call sign every 10 minutes and at 
the end of a transmission. Imagine 
my outrage when I heard a regular 
contributor to 146.730 thumbing his 
nose at this rule! He’d always sign 
off with “Remember, remember, the 
fifth of November”. The first time it 
was funny, but after a half-dozen of 
these flippant sign-offs I complained, 
straight to the trustee! 


Then I went to my first in-person club 
meeting at the EOC. Now imagine my 
discomfort at realizing I was simply 
hearing the phonetic pronunciation of 
NN3V in his distinctive voice. 


I wanted to slide under the table. I 
told the trustee “Never mind about 
that complaint. I figured it out.” 


-Totally Anonymous Forever 


Do you decorate your tower or ham shack? Share your photos! scope@palomararc.org 
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by Glen KJ6ZQH 

In September, 2015, the instructor of the Engineering Technician program at MiraCosta College, 

Kris Rolfson, contacted the Palomar Amateur Radio Club via email. He explained that because he 

is a Ham radio operator himself, he was using the ARRL Technician License Manual as the basis for 
introducing RF concepts to his students. His course covers a broad spectrum of subject matter; 
electronics, mechanics, pneumatics, automation, robotics, etc. His goal was to have his students take 
the Technician license test at the end of this part of the class. 


Kris invited us to tour the facility and to speak to the class (for about 30 minutes) about Ham Radio. 
Charlie (NN3V) and I (KJ6ZQH) visited the school on September 28th. Charlie had created a slide 
set that covered what Ham radio is, some history, the requirements to obtain an operator license, 
hardware & antennas, what you can do as a Ham (including assisting in emergencies), etc. I think 
we spent well over a hour with the class as the students engaged us with questions. PARC gained a 
new member that day as Kris used the online application facility to join the club that afternoon. 


A few days later Kris asked if we 
would come back and talk about 
repeaters. Specifically those 

for VHF and UHF. Charlie and I 
returned on October 15th. We 
had a discussion with the entire 
class on line-of-sight propagation 
and repeater offsets and PL 
codes. Because it was the day 

of the California Great Shakeout 
practice drill, we took the class out 
to Charlie’s car and made contact 
with Brian (AG6GF) in his role as 
net controller on the 145.180 MHz 
repeater. It was very helpful in 
demonstrating repeater offsets and 
operation in that I had a handheld 
radio and could explain that what 
I was receiving was NOT directly 
from Charlie’s radio, but was what 
the repeater was transmitting from 
the top of Mr. Woodson. 


After that we used Charlie's 
antenna analyzer on a antenna 
which one of the students had 
built and had been installed onto 
the roof of the school building. I 
_ believe the meter showed it was 
less than 1.4:1 over the entire 2 
meter band. We broke the class 
up into two groups and Charlie 
and I each took a group for 
some hands on with radios. The 
students already had printouts of 
lists of SoCal repeaters. I made 
sure that each student got to 
input a repeater frequency, set the 
appropriate PL code and to verify 
Charlie NN3V and Glen KJ6ZQH in front of the class. the automatic offset matched the 
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picture of Charlie at this car during demonstration 


published listing for that repeater. 


Jo Ashley (KB6NMK) coordinated getting herself, Charlie and five other volunteer examiners to the 
school on November 17th to administer Ham license tests. Six of the seven students earned their 
Technician Class licenses that day! Harry (W6YOO) spoke to the group about Ham Radio after the 
tests were completed. 


While the VE’s were administering the test, I spent time with Kris on a cruise thru the lab area 

to get pictures of the equipment used by the class; a couple of robots, a number of automated 
manufacturing training stations (with PLC controllers), work areas with power supplies, meters, 
oscilloscopes, soldering stations, hot-air surface mount solder and desolder units. They also have 
four 3D printers. 


The students are wrapping up their 15 week course by constructing their final project. One is 
using a Rasberry Pi to create a monitoring system for a nearby facility the sends email alerts if the 
temperature in a process refrigerator falls out of range. The other students are working in teams 
of two to build aquatic remotely controlled vehicles. Here is a short video of the initial testing of a 
couple the units. Detail photographs can be found on the next page. 


https://youtu.be/ik3Q07pGDZ8 


It was a great experience to visit the school and to interact with these very motivated students. I 
came away enthused by their engagement in the course material in their pursuit of a broad hands-on 
technical education. You can learn more about this course by writing to TCI@miracosta.edu to attend 
one of their weekly tours of the facility. 
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*' _ = "Hee. isan aquatic remotely controlled 
ee vehicle still under construction. The 
» four propulsion motors aré mounted 

n ifi@ependent,axles for directional 
Ontrol. The propellers were created 
in class using the 3D printers. 


This is a camera! 


This one if modified after 
its initial test in the pool. 
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Reported ATV Status as of 27 Nov 


Would you like to help us revitalize our ATV system? We could use 
your help. Contact board@palomararc.org to volunteer. 


915 MHz WBFEM in 
5.8 MHz audio subcarrier 


PARC 

AIV 

System 146.415 
79.7 
intercom 


1241.25 MHz VSB out | 
NTSC standard 


[= 4 operational 


6.0 MHz audi@subcarrier a non-operational 
Circle Diameters Scaled to 


Show Relative Wavelengths 
Between Equipment 
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2016 SW Division Convention 


Yuma, Arizona wn 


Feb. 19 & 20, 2016 


Yuma County Fairgrounds 
2520 East 32™ Street, Yuma, Arizona 


www. yumahamfest.org 


Check the Website for Additional Information 


Gates Open for Camping 
Thursday, 2 pm 


Hamfest Dinner & 
Grand Prize Drawing 

Friday, Noon - 5 pm Saiidauniant 
Vendor Setup Saturday, 8am-5pm ae 

Friday, 7 am - Noon : 6:00 - 8:00 pm 


Event Hours 


Vendors & Exhibitors Tailgating (Swap Meet) 


Consignment Sales Full Seminar Schedule 
License Testing DXCC Card Checking 
Hourly Door Prizes Incredible Grand Prizes 
On-site RV Camping Emergency Preparedness 
Hamfest Dinner Admission Prize 

ARRL Speaker Hospitality Area 
Transmitter Hunt Near Space Balloon Launch 
$5.00 Admission Antenna Clinic 


Hamfest Talk-In Frequency: 146.840 (—) PL 88.5 Hz 


Email Contact: info@yumahamfest.org 


We are proud to have the Amateur Radio 
Council of Arizona (ARCA) as a sponsor of 
our event. 


The Yuma Hamfest is an American Radio 
Relay League (ARRL) sanctioned event. 


Presented by the Yuma Amateur Radio Hamfest Organization 
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W6NWG Awarded Worked All States 


PARC recently submitted a number of Field Day logs to the ARRL’s Logbook of the World, which 
automates the process of QSLing contacts and qualifying for awards. It’s routine for the club’s 
Field Day operation to contact all the states, but getting all the QSL cards and sorting them out for 
an award submission has been a bit harder. Not anymore! Here are the club’s Worked All States 
certificates earned so far. 


The Mixed mode certificate certifies that the club worked and confirmed contacts with all 50 states, 
using some combination of all bands and all modes. The 20 Meters endorsement sticker on that 
certificate shows that we worked all states on just the 20 meter band. Likewise, the Phone mode 
certificate shows that we worked all states using just the phone mode. 


The club must be close to qualifying for a CW mode certificate, and for other band endorsements, 
from Field Day activity alone. We'll continue to submit logs to Logbook of the World. If you have 
an WE6NWG logs (written or online) please send them to the trustee (wSnyv@yahoo.com) for 
submission. 


ARRL put the trustee’s name on the certificates instead of the club’s name. We'll see if we can get 
that fixed. 


pn, WENWG 


1 
i fae et 
os 
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Henry and Rose check out SLEEP system, by Robert Todd KJORET. This is one of 
their favorites! They each got a System Fusion hat from Red Cross. 


BE E FA iit s 
Don WD6FWE models the System Fusion 
hats that were given away at the Red Cross 
booth at Operating Day 


Ef} “fl _ 
Glen KJ6ZQH toured and 
talked. 


Not just System Fusion hats from Red Cross, but also donuts! Rose hears that 
they are actually ham vitimin pills. 
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Yaesu MH-85A11U Teardown 


Camera Microphone used with FT1D, FT2D, and FTM-400 System Fusion Radios 


Michelle Thompson WSNY V 
Paul Williamson KBS5MU 


Introduction 


Yaesu offers an optional camera-equipped microphone (MH-85A11U) for use with the company’s newly 
introduced System Fusion radio line. Currently, the line includes the FT1D and FT2D handhelds and the FTM- 
400 mobile rig. 


Taking photos with the camera microphone requires a properly formatted microSD card to be inserted into the 
radio. The photos and the files that manage the photos are stored on the SD card.! 


The question that motivated this teardown was the nature of the interface between the camera microphone and 
the radio. The camera is referred to as USB Camera in the configuration menus. Could the interface simply be 
USB? 

Inspecting the socket revealed what appeared to be a proprietary connector. See Figure | and Figure 11. No 
information about the pinout was included in any of the various manuals. No information about the pinout was 
available from Yaesu’s USA sales staff. 


Figure 1: Camera Microphone Cable 


Figures 1 through 16 can be found following the text. 


1 See Palomar Amateur Radio Club’s April 2015 newsletter, Scope, for an introduction to the file system 
and basic photography functions. http://www.palomararc.org/Scope/apr15scope .pdf 
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Investigation 


A camera microphone was purchased and tested. The microphone was connected to an FTM-400. Proper 
microphone function was observed, but the speaker function does not seem to be supported on the FTM-400. 
Photographs were taken and saved to the SD card. These photographs were successfully sent over the air. 

The camera microphone has three buttons. The usual push-to-talk (PTT) button is located in the traditional place 
on the side of the handheld microphone. A button with an image of a camera on the front serves as the shutter 
button for the camera. A data transmission start button (marked D-TX) on the front sends the most recently 
taken photograph over the air. See Figure 2. The back plate of the microphone is held in place with four screws. 
These were removed. See Figure 3. Once removed, shielding on the inside of the back plate and the main board 
of the microphone were revealed. See Figure 4. 


The back plate was set aside and the main board examined. See Figure 5. 


We immediately marveled that there was an ARM processor onboard. It was marked “ARM STM32F207 
ICH6”, which identified the chip as a ARM Cortex-M3 based microcontroller manufactured by 
STMicroelectronics. ST describes this chip as featuring a “120 MHz CPU/150 DMIPS, up to 1 Mbyte 

of Flash with advanced connectivity and encryption, adding Ethernet MAC and camera interface to the 
STM32F205/215, and more GPIOs and features on larger packages.” ” 


That’s a lot of compute horsepower for a microphone! We speculated that the microcontroller was simply the 
cheapest solution for integrating a very small package camera via USB to a host device. There are two USB 
ports on the microcontroller. 


To the left and slightly above the microcontroller was a chip marked CY62138EV30LL-45BVXI. That makes it 
a 256kB by 8 bit 45ns static RAM device from Cypress Semiconductor. 


We believe the 8-pin package below the memory to be an audio amplifier. 


The 5-pin device below and to the right of the microcontroller is a voltage regulator. It appeared to take in 5 
volts (supplied by the radio, just as it would be supplied by the host in a standard USB device) and produce 3.3 
volts (which is within the 1.8 to 3.6 volt range required by the microcontroller). 


This board was marked “1489-04880(3)-10 PCB)AAJ40X main”. We called it the main board. 


Next, we examined the board where the camera was mounted. This board was mounted perpendicular to the 
main board. It was marked “1489-04870131-5 PCB)AAJ40X sensor”, so we called it the sensor board. 


The sensor board lifts out from a niche in the top of the opened microphone. It is attached to the main board by 
a copper foil ground strap (soldered to the main board and somewhat fragile) and a ribbon cable with 10-pin 
connector. See Figure 7. The front housing of the camera can be removed by removing the two screws visible in 
Figure 7. After the housing is removed, the camera body can be inspected. See Figure 8. It’s a common webcam 
form factor. For example, it is visually very similar to, but not identical to, the Raspberry Pi camera. The length 
and width of the square body are the same, but the Raspberry Pi camera body is taller. 


No useful part numbers were found on the camera board or body.sWe speculated that the camera lens focus 
distance might be adjusted by turning the lens, but we didn’t attempt this. 


fi This microcontroller family is discussed at http://www.st.com/web/en/catalog/mmc/FM141/ 
SC1169/SS1575?sc=stm32f2 
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This camera doesn’t seem to have autofocus. Since its focus is fixed, there is an ideal depth of field where 
photos will look sharpest. The camera was refitted to its housing and reinstalled in the niche at the top of the 
microphone. 


Continuing with disassembly, the three screws that held down the main board to the front housing of the 
microphone were removed and the board lifted up and to the side. The microphone and speaker wires remained 
attached. See Figure 9. 


Visible in this view was the back side of the D-TX and shutter buttons. The microphone was friction fit into a 
cylindrical housing. The speaker was installed in the front housing. Aside from the two pushbutton switches, no 
components were observed on the back side of the main board, so ws reinstalled it into the front housing. 


The next area of investigation was identifying the signals on the pins corresponding to the microphone cable. 
We were looking for evidence that this interface was simply USB, or USB plus a few other signals. Having a 
standard interface available from the microphone would be desirable, as one could interface another camera or 
photo-serving device to the radio, or possibly improve or expand the performance and capabilities of the Yaesu 
MH-85A110U. Being able to use the Yaesu MH-85A11U with other devices was also raised as a possibility. 
These objectives could be more easily enabled if the interface could be defined. 


The cable enters the bottom of the handheld microphone. The individual wires then go to an 11-pin connector 
with reference designator CN1. We called this connector 1. See Figure 10 


Not all of the pins of the connector were populated in the cable. During the first pass, the following pins were 
identified and the cable wiring color code noted. 


Table 1: Pins Identified with Multimeter 


pb [white S| OSOSOSOSOOC‘d 
B [ra SOdPOOSOSOSOOOCCSCSCSCS 
[4_[Nocomecton [SSCS 


[6_[Brown SiS OSOSOSOSOSOSOSSOCSCSCSC“‘~*S 
7 _[Nocomection [—SSSSS—S—S—S—SC~C~*S 
[&__[Nocomnection _[———SS—S—SSC*?F 
os [Yeow Sd OSOSOSOSOOOCOCSC‘“‘* 


With power provided to the radio, and the radio switched off, no signals appeared at connector 1. With the 
power switched on, signals appeared at the connector. 


When the PTT button was pressed on the side of the microphone, the 3.3 volts normally observed at pin 10 
(PTT) was pulled about halfway down. Obviously, this is not a standard USB pin. This signal is also connected 


to the microphone element itself. 


Next, an oscilloscope was used to more closely examine the pins. 
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Table 2: Pins Identified with Multimeter and Oscilloscope 


1 
2 
3 


data burst every Ims 


data burst every Ims, very close to differential of pin 2 


4 nothing 


a 
4 
3 
i 
6 
a 
el 
a 


1 


PTT normally 3.3 volts high pulled about halfway down by pressing PTT 
button 


On the oscilloscope, busts of data at Ims intervals were observed on pin 2. An image was made of the data 
burst. See Figure 12. Pin 3 also had bursts of data at ms intervals. This is very encouraging, since an idle 
USB Full Speed interface should always have Start of Frame (SOF) packets at regular 1ms intervals. A second 
oscilloscope probe was connected, so we could see the timing relationship between the signals on pins 2 and 3. 
See Figure 13. 


Looking at the waveforms, the data rate was estimated at approximately 12Mbps, which corresponds to the Full 
Speed Data Rate of the USB standard. The signals on pins 2 and 3 wereymostly differential, meaning the same 
signal appears on two different wires, but with one wire going high when the other goes low, and vice versa. At 
the end of each burst, as shown in Figure 13, both signals go low together for about two bit-times. This is called 
a Single-Ended Zero (SEO), and is exactly what you’d expect to see as an End Of Packet (EOP) marker on a 
standard USB signal. 


If this is indeed a SOF packet, it should consist of an 8-bit Sync pattern (constant), followed by 8 bits of 

Packet Identifier (PID, also constant), 11 bits of Frame Number (varying), 5 bits of CRC (varying) for error 
detection, and the EOP. That should take 34 bit times, plus overhead for NRZI encoding, for a duration of about 
2.8 microseconds. That is completely consistent with our observations. We saw the first part of each packet 
remaining constant, and the later portion varying, followed by a consistent SEO. 


With differential signaling, The receiving circuit responds to the voltage difference between the two signals, 
rather than the difference between a single wire and ground. This makes it more immune to common-mode 
noise induced on both wires, which can be a big advantage. Often differential signaling is used with positive 
and negative voltages, which maximizes this advantage, but requires a negative supply. Like standard USB, this 
interface uses only low (near zero volts) and high (about 3.3 volts) states. 


When PTT was pressed, the data burst did not appear to grow in size. The part that stayed the same continued 
to stay the same, and the part that was rapidly changing continued to rapidly change. When a photograph 

was transmitted, no change in size or nature of the data burst was observed. Apparently no data is transmitted 
between the microphone and the radio for these two activities, which makes sense. 


An additional amount of signaling was observed to follow the periodic (SOF) data burst. This second packet 


wasn’t always transmitted, but when it was transmitted, it always followed the first burst and always occurred 
after the same amount of delay. See3Figure 14 for an image of both bursts. We have not decoded the second 
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packet, but it also appears to have the standard structure of a USB packet, including the sync pattern and SEO 
EOP marker. 


The FT1D handheld operated in a similar manner. The only difference discovered was that the speaker in the 
camera microphone worked as a speaker. When attached to the FTM-400, the speaker in the camera microphone 
was silent. With the FT1D connected, we probed the connector looking for the speaker audio, without finding 
anything. Since the audio doesn’t come in as an analog voltage, We assumd that the audio was coming in 
through data on pins 2 and 3, but we have not verified that assumption 


We decided that we would need a logic analyzer, or a USB protocol analyzer, to better study these signals. We 
had a basic logic analyzer on hand. This particular model is an FPGA-based open hardware design called the 
Open Bench Logic Sniffer. Of the several host programs designed to control and interface with that kind of 
logic analyzer hardware, we ran the recommended Java client “Logic Sniffer” on a Mac. 


We attempted to solder some wire wrap wire to the connector in order to more easily connect the leads. The 
solder on the connector turned out to be very high temperature solder, and we were reluctant to risk damaging 
the connector by applying enough heat to melt the solder. Instead, we connected a ground wire on the large 
ground pad on the main board, and held the Logic Sniffer test leads to pins 2 and 3 manually to capture the data. 
Data was captured, and the SOF data bursts seen on the oscilloscope were also seen on the Logic Sniffer. The 
next experiment was to take a picture and see if image data could be captured by the logic sniffer. This was 
successful. When the shutter button is pressed, a large amount of data is transmitted over pins 2 and 3 to the 
radio. See Figure 14. When the review screen was zoomed out, it was observed that the data came in batches 
about 50 microseconds (about 600 bits) long. See Figure 15. 


The Open Bench Logic Sniffer doesn’t have a very large memory, so even with the camera ses to capture at the 
smallest size and lowest quality the entire transmission of data from camera to the phone could not be captured 
in full detail. We were able to confirm that the amount of data transmitted was about the same as the file size as 
stored on the microSD card, so presumably the JPEG encoding is being done in the microphone. The analyzer 
also has relatively primitive triggering features, so we weren’t able to capture the beginning of the transfer, 
where the standard JPEG file signature would be readily identifiable. Ideally we'd like to capture the entire 
exchange, to confirm how the file is being transferred. 


Next steps in this direction would require a more capable logic analyzer or, preferably, a dedicated USB 
protocol analyzer. 


Software-based USB protocol analyzers are available, including some for free. It’s possible we could learn 
more by using one, but they are really intended for use when a device is connected to a standard computer. In 
this case, where we have a proprietary device connected to a proprietary host, we really need to use a hardware 
based analyzer. 


There are several USB hardware analyzers on the market. One relatively low cost unit is the Beagle USB 

12 from Total Phase. It can handle the 12 MHz “Full Speed” interface used here, but no faster. It costs $400, 
and comes with software that is artificially limited in its ability to decode USB transactions. Most hardware 
analyzers are much more expensive. Purchase was put on hold pending the results of some inquiries about 
borrowing time on an existing USB protocol analyzer or logic analyzer. 


There are also software-based USB protocol analyzers, including some for free. Of course, they are intended 
for the case where the device is connected to a standard host computer. They would not be directly useful 
for the case of the camera microphone connected to the transceiver, but they might be useful if the camera 
microphone’s interface is close enough to standard USB to be recognized by a computer. 
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We had seen enough evidence to support our guess that the data interface on pins 2 and 3 might be standard 
USB. To put this theory to the test, we decided to try hooking up that interface to a computer’s USB port and 
see if it would be recognized. 


A standard USB cable was partially disassembled, and pins 2 and 3 and power and ground from the camera mic 
were connected to the corresponding pins of the USB cable. The USB cable was connected to a MacBook Air 
running Mac OS X 10.10.3 Yosemite. Nothing visible happened. The wires for pin 2 and pin 3 were reversed. A 
USB message was then captured from the console. 


afie7is @F39200.000 2M kernel[0] USBF: Taio lg2l9 The IOUSBFamily is 
having trouble enumerating a USB device that has been plugged in. It will 
keep retrying. (Port 2 of Hub at 0x6000000) 


4/18/15 8:33:02.000 PM kernel[0O] USBF: 15723,357 The IOUSBFamily 
was not able to enumerate a device. 


These messages speak of difficulty “enumerating” the device. That refers to an essential step in the USB 
protocol that enables plug-and-play operation with many USB devices. Normally, a newly connected USB 
device will respond in a particular way that enables the host computer to recognize exactly what type of device 
it is, so that the right device driver software can be activated to use the device. 


The error is a fairly generic one. It suggests that the computer was able to tell that something had been 
connected, but that it could not complete the basic handshake to find out what had been connected. This kind 
of error can be caused by cable problems (our pin-probing arrangement wasn’t exactly according to USB 
standards) or it could be a software issue on either end. The next step here would be to make solid connections 
to the data pins and try to capture the attempted enumeration on a logic analyzer. 


Despite the failure to enumerate the camera mic as a standard USB device, we think the chances that the 
interface is basically USB and can be made compatible with other devices are still pretty good. 


Summary 


The interface between the radio and the microphone does appear to rely on USB or USB-like signaling. Signals 
were identified, and data captured that does appear to be USB packets. USB allows for a variety of potential 
experiments and applications with System Fusion radios. 
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Figure 2: Front View of Camera Microphone 
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Figure 3: Removing the Back Plate 
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Figure 4: Back Plate Removed 
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Figure 5: Main Board 
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Figure 6: ARM STM32F207 ICH6 


Figure 7: Sensor Board Lifted Out 
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Figure 9: Back of Main Board and Speaker 
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Figure 10: Connector CN1 
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Figure 11: Camera Microphone Plug Detail 
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Figure 15: Data from Pin 2 and 3 During Shutter Press 
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Figure 16: Data from Pin 2 and 3 During Shutter Press Zoomed Out 
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Signal Adventures: SigGens from China 


Article and photos by Paul KBSMU 

At the November meeting of the San Diego Microwave Group, Kerry N6IZW showed a recent eBay 
purchase: a little black box described variously as something like “138MHz-4.4GHz USB SMA Source/ 
Signal Generator/Simple Spectrum Analyzer”. It looked like a good deal, so I ordered one too. It cost 
$63.69 including free shipping from Shenzhen, China, and comes with a USB cable, two 12-inch SMA 
cables, and a mini CD of related software. There are other configurations available, including one with 
a wider frequency range (35 MHz to 4.4 GHz) for a bit more money, one without a box for a bit less 
money, and even one with a built-in ARM-based microcontroller (STM32F103) with a color LCD display 
programmed as a user interface for the device. 


The 3” mini-CD was the first challenge. These 
don’t work in slot-loading drives, much less in 
modern computers that have no optical drive at 
all. I tend to keep old computers, so I didn’t have 
much trouble finding one with a tray-loading drive 
that could read the disc. See the screen shot. 

The filenames are in both Chinese and English, 
and clearly some of the files on the disc refer to 
some other product (a GPS disciplined oscillator). I 
decided to set the disc aside and look for software 
on the internet instead. There's a callsign visible in 
the disc's directory listing (BG7TBL) so I decided to 
search for that. 


The search was fruitful. I found out that BG7TBL 
was the original designer of the device, and that it 
is based on an Analog Devices ADF4350 wideband 
synthesizer with integrated VCO. It contains an 
The BG7TBL signal generator and spectrum analyzer device. FIDI USB-to-serial chip to provide the computer 
interface, which doesn’t require a unique driver 
because it looks like a standard USB serial port. There was also a link to http://www.dl4jal.eu for 
software. The good news is that DL4JAL’s LinNWT software runs on Windows, Macintosh, or Linux. 
The bad news (for me) is that it’s in German. There’s a manual that’s “in English” but it appears to be 
a machine translation. 


4 Files Currently on the Disc (8) 

|. BG7TBL GPS3\|ARSD24) BG7TBL GPS disciplined clock 

). NWT3451/2950(2 241 nwt serial sweep analyzer 

). {2:9G6Ps9l| ARR. HW(HUAWED GPSDO board 

| S382, 8528241 simple spectrum analyzersimple signal generator 
NWT345) 7330 24] nwt serial sweep analyzer.rar 
16 5)GPS4|ARiRAA HW(HUAWED GPSDO board.rar 
HS ARHRAB 241 TRIMBLE GPSDO board.rar 
S82 SSSR 2A simple spectrum analyzer,simple signal generator.rar 
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VFO screen of LinNWT running on the Mac, generating 146.730 MHz after the 10X multiplier. 


OK, German is almost like English, right? I decided to try using the software first (though I usually 
prefer to read the manual). I loaded the Mac OS X version of the LinNWT software, found the “VFO” 
tab, configured it to generate a 1GHz signal, and hooked it up to W5NYV’s Tektronix 492 spectrum 
analyzer. Setting up the spectrum analyzer to look in the vicinity of 1 GHz, I saw nothing. Tuned 
around, and still saw nothing. Did I get a bad unit? 


Back to the web. I found an article on the device at http://dalbert.net/?p=219, which confirmed that 
the LinNWT software is only available in German with minimal English documentation. It reports 
that the signal source is pretty clean except for the third and higher order harmonics, which are not 
filtered, and that his unit showed about 7ppm of frequency error. Not bad for such inexpensive test 
equipment. The author compiled his own version of the software to run on Linux. The configuration 
settings he mentions appear to be in English. In particular, I noticed mention of a “frequency 
multiply” setting of 10. I couldn’t find any such setting in the German OS X program, but I wondered 
if I was missing a factor of 10 in frequency. So, I tried setting the program to 100 MHz instead of 1 
GHz. Sure enough, with the program set to one-tenth the desired frequency, I could see the signal 
on the spectrum analyzer. 


I then wanted to see for myself just how bad the harmonics were, so I configured the unit to 
generate a frequency near its lower limit. Just for fun, I chose 146.730 MHz. Then I configured 
the spectrum analyzer to sweep from DC to 1.8 GHz, which is as far as it would go in a continuous 
sweep. See the photo. Sure enough, there are strong harmonics all the way up. For comparison, I 
hooked up a Yaesu VX-7R I had handy, and saw that it was very much cleaner. See photo. 
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Spectrum analyzer screen of LinNWT running on the Mac. 


I also spent some time looking for higher harmonics. In the popular microwave ham band at 10 
GHz, the harmonics were strong and easy to find, so this device will be useful as a marker generator 
in that range. With some fiddling, I was able to find harmonics up to 18 GHz, near the top of the 
spectrum analyzer’s range. 


I was originally interested in this device as a signal generator, but it also claims to work as a 
spectrum analyzer, though it doesn’t have any resolution bandwidth filters. I wondered if it would 
be of any use. I connected a 2m whip antenna for an HT to the device’s input connector, set it to 
scan from 140 to 150 MHz, and used the VX-7R to transmit a test signal, again at 146.730 MHz. 

See photo. Sure enough, there’s a big signal from the nearby transmitter. You can also see a smaller 
signal, which appears to be around 148.5 MHz. That signal doesn’t depend on the signal from the 
VX-7R; it’s really there. See photo. I tuned the VX-7R to 148.5 MHZ and heard the signal on the HT 
as well. Searching around the room foxhunt-style, the signal seemed to be coming from the Mac. So 
the spectrum analyzer function has already proven its worth, by spotting a spurious emission from 
Sauipe in the shack. Once I knew the signal was there, I could find it on the Tek 492 as well. See 
photo. 


I wanted the English user interface, so I decided to compile LinNWT under Raspbian Linux on the 
Raspberry Pi. Following the instructions from the article, it built with no hassle, and ran with a 
mostly-English user interface when run as specified (using a command line argument of app_en.wm, 
which refers to the English localization file). The only catch was that the device wouldn’t power up 
when connected directly to the Raspberry Pi’s USB port, probably because there wasn’t enough 
current available. Moving the device to a powered USB hub solved that problem. In the English user 
interface, I found where the frequency multiplier is set, and the same location in the German version 
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on the Mac did the same thing. Apparently it has to be set to 10 to make the frequency displays 
match reality. 


Back on the Mac, I found I could get the same partially-English UI by copying the app_en.wm file out 
of the Linux distribution and starting the Mac program with the same command line argument as on 
Linux. I couldn’t find a way to make that automatic, though, short of writing an Applescript. Windows 
users, you get the localized user interface automatically by choosing English when you install the 
program. 


Tek 492 spectrum analyzer screen showing a clean carrier on 146.730 MHz from 


Tek 492 spectrum analyzer screen showing extensive harmonics generated by the ha WTR 
the -/ KR. 


device. 


The BG7TBL signal generator and spectrum analyzer device, bottom of circuit 
board. 


The BG7TBL signal generator and spectrum analyzer device, top of circuit 
board. 
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LinNWT spectrum analyzer plot showing the VX-7R transmitting on 146.730 
MHz and a mystery signal around 148.5 MHz. 
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Tek 492 spectrum analyzer screen showing a close-up of the mystery signal at 148.5 MHz. 
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LinNWT spectrum analyzer plot showing just the mystery signal around 148.5 
MHz. 
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Repeater Site Technical Video Report 


Among other tasks, Repeater Technical Chair Mark KF6WTN and PARC President Charlie NN3V 
investigated a complaint about the 147.130 machine squelch level. With able assistance from Joe 
WB6IQS, Mark was able to adjust the squelch. Reports after the adjustment were good. Here’s a 
video of the teamwork in action. 
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Editor: Michelle Thompson WSNYV 
Submissions: scope@palomararc.org 
Questions? Ideas? Comments? W6NWG@amsat.org 


Featured Program: 

At 7:30pm on 2 December 2015, Palomar Amateur Radio Club will hold elections for the 2016 board of 
directors and whether or not to grant Mike Pennington KOMRP Life Membership in PARC. Come at 7pm to 
socialize and brng a dish to share. We look forward to seeing you at the Carlsbad Safety Center, 2560 Orion 
Way, Carlsbad, CA. 


Sign up for the PARC Email Lists: 


http://www.palomararc.org/mailman/listinfo 
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